Security App
Code:
mfehidk.sys Wed Jan 16 00:21:15 2013 (50F59E1B)
mfewfpk.sys Wed Jan 16 00:21:30 2013 (50F59E2A)
mfeapfk.sys Wed Jan 16 00:21:56 2013 (50F59E44)
mfeavfk.sys Wed Jan 16 00:22:16 2013 (50F59E58)
mfefirek.sys Wed Jan 16 00:24:04 2013 (50F59EC4)
Crashes indicate McAfee being a possible cause. Remove McAfee and replace with Microsoft Security Essentials to see if it provides more stability. Uninstallers (removal tools) for common antivirus software. Microsoft Security Essentials and Malwarebytes are recommended from a strict BSOD perspective. They do not cause blue screens on the system as other AV products do.
Microsoft Security Essentials, Free antivirus for windows and Malwarebytes Anti-Malware Free
This tutorial USB Selective Suspend - Turn On or Off may help you:
To Disable Selective Suspend:
1. open the control panel
2. go to power options (you may have to set view to small icons)
3. click change plan settings
4. in the window that opens:
5. click change plan settings
6. click change advanced power settings, expand usb and ensure usb selective suspend is disabled.
Then update the Logitech Camera driver below to its latest: Driver Reference Table - lvrs64.sys
Code:
*** WARNING: Unable to verify timestamp for lvrs64.sys
*** ERROR: Module load completed but symbols could not be loaded for lvrs64.sys
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffff8800691ff8a, fffff88002acc758, fffff88002acbfb0}
Probably caused by : lvrs64.sys ( lvrs64+2f8a )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8800691ff8a, The address that the exception occurred at
Arg3: fffff88002acc758, Exception Record Address
Arg4: fffff88002acbfb0, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
lvrs64+2f8a
fffff880`0691ff8a 45396924 cmp dword ptr [r9+24h],r13d
EXCEPTION_RECORD: fffff88002acc758 -- (.exr 0xfffff88002acc758)
ExceptionAddress: fffff8800691ff8a (lvrs64+0x0000000000002f8a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 00000000004a6e84
Attempt to read from address 00000000004a6e84
CONTEXT: fffff88002acbfb0 -- (.cxr 0xfffff88002acbfb0)
rax=0000000000000000 rbx=fffffa800e1e1860 rcx=0000000000000001
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8800691ff8a rsp=fffff88002acc990 rbp=00000000004a6e60
r8=0000000000000000 r9=00000000004a6e60 r10=0000000000000002
r11=00000000004a6e60 r12=fffffa800e1e3900 r13=0000000000000000
r14=00000000004a6e60 r15=00000000004a6e60
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
lvrs64+0x2f8a:
fffff880`0691ff8a 45396924 cmp dword ptr [r9+24h],r13d ds:002b:00000000`004a6e84=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 00000000004a6e84
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002efb100
GetUlongFromAddress: unable to read from fffff80002efb1c0
00000000004a6e84 Nonpaged pool
FOLLOWUP_IP:
lvrs64+2f8a
fffff880`0691ff8a 45396924 cmp dword ptr [r9+24h],r13d
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from 0000000000000001 to fffff8800691ff8a
STACK_TEXT:
fffff880`02acc990 00000000`00000001 : fffffa80`00000000 00000000`00000000 00000000`00000000 fffffa80`0dacb800 : lvrs64+0x2f8a
fffff880`02acc998 fffffa80`00000000 : 00000000`00000000 00000000`00000000 fffffa80`0dacb800 00000000`00000000 : 0x1
fffff880`02acc9a0 00000000`00000000 : 00000000`00000000 fffffa80`0dacb800 00000000`00000000 00000000`00000000 : 0xfffffa80`00000000
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: lvrs64+2f8a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: lvrs64
IMAGE_NAME: lvrs64.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4f166964
STACK_COMMAND: .cxr 0xfffff88002acbfb0 ; kb
FAILURE_BUCKET_ID: X64_0x7E_lvrs64+2f8a
BUCKET_ID: X64_0x7E_lvrs64+2f8a
Followup: MachineOwner
---------
3: kd> lmvm lvrs64
start end module name
fffff880`0691d000 fffff880`06970a80 lvrs64 T (no symbols)
Loaded symbol image file: lvrs64.sys
Image path: \SystemRoot\system32\DRIVERS\lvrs64.sys
Image name: lvrs64.sys
Timestamp: Wed Jan 18 12:40:36 2012 (4F166964)
CheckSum: 00061E9E
ImageSize: 00053A80
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Tip
How to clean left over drivers
Sometimes drivers remain, not completely uninstalled. Follow this tutorial for complete removal of drivers of the particular program:
How to Clean Left Over Driver Files with Driver Sweeper
- Click on the Start
- Control Panel
- Programs
- Uninstall a program
- Uninstall everything related to the software
Delete remnants of its drivers/older drivers using
Driver Sweeper
Some more drivers from logitech to be updated:
LHidFilt.Sys Wed Jun 17 22:49:39 2009 (4A391EA3) - Logitech SetPoint HID Filter Driver
LMouFilt.Sys Wed Jun 17 22:49:43 2009 (4A391EA7) - Logitech SetPoint HID Filter Driver
athrx.sys Mon Oct 5 22:33:57 2009 (4ACA1FF5)- Atheros network adapter driver
Atheros Driver
If its wireless, match your device from here:
ATHEROS Wireless drivers for Windows
If its not a wireless, match your device from here:
ATHEROS Network drivers for Windows
Please run these tests and report back the results
1. SFC /scannow to check windows for corruption - SFC /SCANNOW Command - System File Checker
2. Disk check for errors on the hard drive - How to Run Disk Check in Windows 7
3. Troubleshoot applications by a clean boot - Troubleshoot Application Conflicts by Performing a Clean Startup
4. Memtest86+ paying close attention to part 3 - RAM - Test with Memtest86+
5. Hard drive test from HDD mfg website - Hard Drive Diagnostic Procedure
BSOD BUGCHECK SUMMARY
Code:
Debug session time: Mon Jun 10 08:02:24.460 2013 (UTC + 6:00)
Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
System Uptime: 0 days 4:09:18.800
*** WARNING: Unable to verify timestamp for lvrs64.sys
*** ERROR: Module load completed but symbols could not be loaded for lvrs64.sys
Probably caused by : lvrs64.sys ( lvrs64+2f8a )
BugCheck 1000007E, {ffffffffc0000005, fffff8800691ff8a, fffff88002acc758, fffff88002acbfb0}
BugCheck Info: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
Bugcheck code 1000007E
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8800691ff8a, The address that the exception occurred at
Arg3: fffff88002acc758, Exception Record Address
Arg4: fffff88002acbfb0, Context Record Address
PROCESS_NAME: System
BUGCHECK_STR: 0x7E
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
FAILURE_BUCKET_ID: X64_0x7E_lvrs64+2f8a
BiosVersion = 5022
BiosReleaseDate = 10/20/2012
SystemManufacturer = System manufacturer
SystemProductName = System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Debug session time: Tue May 21 12:42:45.391 2013 (UTC + 6:00)
Built by: 7601.18113.amd64fre.win7sp1_gdr.130318-1533
System Uptime: 0 days 7:53:50.546
*** ERROR: Module load completed but symbols could not be loaded for usbhub.sys
Probably caused by : usbhub.sys
BugCheck 9F, {3, fffffa800e8eb440, fffff80000b9c3d8, fffffa800feae620}
BugCheck Info: DRIVER_POWER_STATE_FAILURE (9f)
Bugcheck code 0000009F
Arguments:
Arg1: 0000000000000003, A device object has been blocking an Irp for too long a time
Arg2: fffffa800e8eb440, Physical Device Object of the stack
Arg3: fffff80000b9c3d8, nt!TRIAGE_9F_POWER on Win7, otherwise the Functional Device Object of the stack
Arg4: fffffa800feae620, The blocked IRP
BUGCHECK_STR: 0x9F
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
PROCESS_NAME: System
FAILURE_BUCKET_ID: X64_0x9F_3_nvstusb_IMAGE_usbhub.sys
BiosVersion = 5022
BiosReleaseDate = 10/20/2012
SystemManufacturer = System manufacturer
SystemProductName = System Product Name
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
Quote
Do not start the free trial of MalwareBytes, unselect that option when prompted.
Update and make full scans with both separately.